Hello and welcome
it seems you' ve a big challenge there:
unlocking a locked client involves gain administrator privileges, booting in safe mode and registry editing.
For the other part, without AD, you could use new 4.0 features for endpoint to force everyone to download the forticlient from the firewall itself;
another approach for massive deployment is FortiManager.
good luck
